You have an Azure Container Registry named ContReg1 that contains a container Image named image1.

Only image2 is trusted. Azure Container Registry ' s Docker Content Trust (DCT) implementation identifies trusted image tags by cryptographic signatures generated when a publisher pushes an image with client-side Docker Content Trust enabled .

Microsoft explains that enabling DCT at the registry level allows clients to push signed images, but enabling the registry feature does not retroactively sign existing images . Therefore, image1, which already existed before content trust was enabled, doesn ' t automatically become trusted. Microsoft Learn

Image2 is pushed after registry content trust is enabled and with client content trust enabled . Its Docker client therefore signs and publishes the corresponding trust metadata, making image2 the trusted image.

Image3 is pushed with client content trust disabled, so it remains unsigned even though the registry itself supports DCT. Microsoft explicitly notes that a DCT-enabled registry can still contain a mixture of signed and unsigned image tags .

There is also a current platform lifecycle point: Microsoft stopped allowing Docker Content Trust to be newly enabled on registries that hadn ' t previously enabled it beginning May 31, 2026 , and DCT is scheduled for complete removal on March 31, 2028. The question nevertheless tests the documented DCT trust semantics.